Server Misconfiguration, SSRF, Uploads and Dependencies

Misconfiguration

• Debug mode off in production (Flask/Werkzeug's debugger allows code execution).
• No default credentials; no admin panels exposed without protection.
• Security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy.
• Directory listing off; error pages without stack traces.
• Secrets in environment variables, never in Git; scan history for leaks.
• CORS restricted to specific origins.

Server-side request forgery (SSRF)

If your app fetches URLs supplied by users (link previews, webhooks, image imports), an attacker can make your server request internal addresses: http://127.0.0.1:6379, cloud metadata endpoints like http://169.254.169.254/ (which can expose credentials), or private network services.

Defences:

• Allowlist domains where possible.
• Resolve the hostname and reject private, loopback and link-local IP ranges, after redirects too.
• Disable redirects or re-validate each hop; set short timeouts and response size limits.
• Run fetchers with no access to internal networks where possible.

File uploads

• Limit size (MAX_CONTENT_LENGTH) and allowed types; verify content, not just the extension.
• Store outside the web root with random names; serve through a permission-checked route with Content-Disposition: attachment for downloads.
• Never execute or include uploaded files; strip image metadata if privacy matters.
• Protect against path traversal: never join user-supplied paths without normalising and checking they stay inside the upload directory.

Vulnerable dependencies

Most code in your app comes from libraries. Keep them patched:

pip install pip-audit && pip-audit
npm audit

Enable Dependabot or Renovate for automatic update pull requests, and pin versions in lock files.

Exercise

Audit a Flask app for misconfiguration (debug, headers, cookies, CORS), add an SSRF-safe URL fetcher that rejects private IP ranges, harden file uploads against path traversal, and run pip-audit in CI.

Check yourself

• Why is the cloud metadata address a common SSRF target?
• How do you prevent path traversal in downloads?
• How do you keep dependencies patched?